website/docs: clarify user and group filtering on scim provider (#22502)

* Provide more clarity on user and group filtering

* provision to synchronized

Signed-off-by: Dewi Roberts <dewi@goauthentik.io>

* Fix em dashes

Signed-off-by: Dewi Roberts <dewi@goauthentik.io>

---------

Signed-off-by: Dewi Roberts <dewi@goauthentik.io>

Author: dewi-tik

website/docs/add-secure-apps/providers/scim/index.md

@@ -95,20 +95,22 @@ You can limit which users and groups a SCIM provider synchronizes. User filterin
 
 ### User filtering
 
-Use **Exclude service accounts** in the SCIM provider settings when you do not want service accounts to be synchronized.
+Users that are synchronized via a SCIM provider are controlled through application access policies. When a SCIM provider is configured as a backchannel provider for an application, only users who are bound to that application are synchronized. A common setup is to bind a group to the SCIM application so that all members of that group are synchronized to the target SCIM endpoint.
+
+If no users are bound to the SCIM application, the SCIM provider synchronizes all users.
 
-Users can also be filtered through application access policies. If the SCIM provider is attached to a backchannel application, only users who can view that application are synchronized.
+When a user is no longer assigned to the application—either directly or through a group—and a SCIM sync task runs, that user is deprovisioned from the target SCIM endpoint.
+
+Use **Exclude service accounts** in the SCIM provider settings when you do not want service accounts to be synchronized.
 
 ### Group filters
 
-Group filters define the synchronization scope for groups.
+Group filters define the synchronization scope for groups. Group filters apply only to groups. They do not limit which users are synchronized.
 
 If no group filters are selected, the SCIM provider synchronizes all groups.
 
 If group filters are selected, only the selected groups are synchronized.
 
-Group filters apply only to groups. They do not limit which users are synchronized.
-
 Changing the selected group filters does _not_ remove groups or memberships that were synchronized previously.
 
 ## Compatibility modes